Project: satisfied-communication Environment: production Service: mcp-production Custom domain: mcp.verittasllc.com Custom domain ID: 406fddef-38fc-44a3-a87d-a6d9f30544bf Expected CNAME: p2lx6u40.up.railway.app The custom domain is shown as valid in Railway and its public CNAME resolves correctly. DNS diagnostics: - CNAME resolves to p2lx6u40.up.railway.app - No AAAA record - No CAA record restricting Let's Encrypt After approximately 72 hours, Railway still serves its default certificate: - Subject: CN=*.up.railway.app - SAN: *.up.railway.app, up.railway.app - Hostname verification: error 62, hostname mismatch The latest deployment remains unchanged: 6d5df5cb-3a6f-4e50-900b-ff15a8ad2f3f Commit: 6655b56abd50b54d3dc8092c0be286aec9bdc6ca The service is intentionally fail-closed and offline with MCP_PRODUCTION_RUNTIME_ENABLED=false. We cannot enable the runtime merely to provision TLS. Please inspect the custom-domain certificate issuance and advise whether the certificate can be issued while the application remains fail-closed. Please do not trigger a deployment, redeployment, domain recreation, or service configuration change without confirmation.

Custom domain validated but Railway still serves *.up.railway.app certificate after 72 hours

iurysouza5

PROOP

7 hours ago

Project: satisfied-communication

Environment: production

Service: mcp-production

Custom domain: mcp.verittasllc.com

Custom domain ID: 406fddef-38fc-44a3-a87d-a6d9f30544bf

Expected CNAME: p2lx6u40.up.railway.app

The custom domain is shown as valid in Railway and its public CNAME resolves correctly.

DNS diagnostics:

CNAME resolves to p2lx6u40.up.railway.app
No AAAA record
No CAA record restricting Let's Encrypt

After approximately 72 hours, Railway still serves its default certificate:

Subject: CN=*.up.railway.app
SAN: *.up.railway.app, up.railway.app
Hostname verification: error 62, hostname mismatch

The latest deployment remains unchanged:

6d5df5cb-3a6f-4e50-900b-ff15a8ad2f3f

Commit: 6655b56abd50b54d3dc8092c0be286aec9bdc6ca

The service is intentionally fail-closed and offline with

MCP_PRODUCTION_RUNTIME_ENABLED=false. We cannot enable the runtime merely to

provision TLS.

Please inspect the custom-domain certificate issuance and advise whether the

certificate can be issued while the application remains fail-closed. Please do

not trigger a deployment, redeployment, domain recreation, or service

configuration change without confirmation.

Awaiting Railway Response

2 Replies

Railway

BOT

6 hours ago

Your CNAME is correctly propagated, but the TXT ownership-verification record is absent, which is why the certificate has not issued. Add a TXT record at the host shown in your domain's settings (the _railway-verify entry for this domain) with the token value displayed there. Your registrar's DNS panel is where this record goes. Once it propagates, certificate issuance proceeds on its own with no deployment or service change needed.

Status changed to Awaiting User Response Railway • about 6 hours ago

iurysouza5

PROOP

5 hours ago

Domain mcp.verittasllc.com remains “Waiting for DNS update”. CNAME is accepted. The required verification TXT matches exactly on both authoritative nameservers, Google DNS, and Cloudflare DNS. TLS hostname verification fails with OpenSSL error 62. Please investigate the pending domain verification without changing DNS, recreating the domain, or triggering a deployment.

Status changed to Awaiting Railway Response Railway • about 5 hours ago

Welcome!